Graduated trust for autonomous patching

Geng Sng, CTO of Cogent, outlines a pragmatic architecture for autonomous cyber defense, moving past AI hype to address the real constraint: the collapse of mean-time-to-exploit from years to minutes. The core insight is that patching speed, not just detection, is the bottleneck. Their platform ingests massive, heterogeneous organizational data—ticketing systems, cloud assets, threat intel—to construct a high-throughput 'context graph' without using a traditional graph database, opting for a data lake architecture to handle billions of daily events.

The system separates concerns across three distinct agents: interactive agents for chat-based analyst queries, background agents for long-running data enrichment tasks, and internal coding agents for accelerating their own dev cycle. This architecture reflects practical engineering trade-offs. Interactive agents undergo a deeper planning phase (which paradoxically speeds up one-shot tasks) and have different latency requirements than background agents. For safety in a high-stakes domain, all customer-facing agents run in deeply permissioned sandboxes with a policy engine that prevents destructive actions even if the LLM hallucinates, a non-negotiable feature for enterprise trust.

Crucially, the path to autonomy isn't a switch but a gradient: customers start in read-only 'assisted' mode, then progress through auto-routing, auto-validation in staging, and finally auto-remediation for low-blast-radius assets. This graduated approach is designed to shrink the attack surface that can be autonomously fixed within minutes, while leaving zero-tolerance systems like payment processors under manual control. The variable challenge is not the patch itself, but predicting its 'production impact'—a task that cuts to the heart of team risk management.

The company differentiates between 'hot' (active, reusable) and 'cold' (archived) context, a more useful framework than short-term vs. long-term memory. Their eval system is multi-layered, using LLM-as-judge harnesses ranging from simple adversarial models to agents with full environmental parity to reproduce and assess a trajectory. For engineering leaders, this signals a future where AI is phased into sensitive production systems through evidence-based trust, not blind automation, with strong safety guardrails and a relentless focus on making organizational context machine-readable.